Counterfactual Transaction-Motif Memory with Market-Crime Drift Attribution for Open-World Cryptocurrency Forensics

Abstract

Cryptocurrency ransomware attribution is intrinsically open world: a forensic learner must identify previously observed campaigns, reject later-emerging families, distinguish criminal-motif change from benign market drift, and prevent uncertain online samples from corrupting its memory. This paper presents CausalLedger-OWL, a counterfactual multi-view framework that separates transaction-shape and value-flow evidence from temporal market context, stores multimodal known-family prototypes, fuses prototype distance, energy, tri-view disagreement, and normalized predictive entropy, attributes drift through separate market and crime statistics, and permits only uncertainty-gated, agreement-gated, source-anchored prototype updates. The revised implementation defines a strict global protocol on the UCI BitcoinHeist corpus: training through 2014, source-only calibration in 2015, and open-world evaluation during 2016-2018 with five dynamically selected known ransomware families and four completely held-out families. The supplied revision completed end-to-end implementation validation and produced all required outputs. Empirical security evidence is reported from a version-controlled predecessor BitcoinHeist pilot containing 26,740 selected addresses. That pilot attained an H-score of 0.2184 and AUROC of 0.5666, below the calibrated MSP baseline (0.2763 and 0.5995), so superiority in unknown-family ranking is not claimed. Its trust gate nevertheless reduced final source-memory forgetting from 0.1561 to 0.0106 and retained known-family accuracy of 0.2905 under 50% unknown contamination, compared with 0.2088 for naive updating. The results localize the defensible contribution to contamination-resistant memory and identify novelty calibration as the principal confirmatory research question.